Highlighting the differences between police and private sector digital forensics

Written by Mark Payton | Forensics Manager at CYFOR

This blog was developed to highlight the comparative difference in practices between the police and private sector digital forensics, such as those provided by CYFOR

To provide some initial background, I am a digital forensics professional with in excess of 10 years experience in the industry. Prior to my role as Forensics Manager at CYFOR, the majority of my career has been spent in digital forensic teams within the police. Whilst at the police force, I held all roles within the digital forensics team and therefore feel well placed to construct a comparative blog between the two disciplines.

Digital Forensic Similarities

It is important to note that CYFOR and all police forces conduct examinations with the highest level of focus on exhibit handling. Chain of custody of exhibits is as important both in public and private sector digital forensics and failure to comply can result in evidence being inadmissible in court. It is also apparent that forensic software used is very similar across the board, with the market-leading providers maintaining a monopoly over most private and public sector communities. As with exhibit handling, working toward criminal or family procedure rules and working towards ISO accredited standards is paramount to the work that CYFOR conduct as with public sector departments. One element of ongoing concern is the demand for work across the board. High demand demonstrates the scale of the problem within the population of the ease to utilise the internet to facilitate criminal activity both with corporate and criminal cases. The demand is growing and as such, CYFOR is growing to accommodate.

It is important to note that CYFOR and all police forces conduct examinations with the highest level of focus on exhibit handling.

Differences in techniques

One considerable difference between public and private sector is the ability to investigate devices thoroughly. Coming from a private background, it was commonplace to download handsets, produce full downloads of the data and send them to untrained officers for review. It would then be the officers’ job to identify relevant material. CYFOR uses trained and qualified staff to drill down into extractions to accurately identify material of evidential value and deliver a report with context as to provenance and attribution. This report carries significant more forensic value than that of an untrained officer.

CYFOR also offers a wider range of services; very different from the work conducted by digital forensics units in private forces. The benefits of this are the shared knowledge base of individuals from different backgrounds, with different qualifications and different skill sets. There is likely to be very little requested of CYFOR that we are unable to do to a high evidential standard. Another considerable difference is the direct client interaction approach that CYFOR adopts, and the regular conversations around updates for submitted work, deadlines, and the general consideration of requirements.

Finally, and a key point is the impact of cognitive bias. Whilst every Organisation has measures in place to avoid cognitive bias, in most cases it is unavoidable. The mindset of approaching an investigation is similar but the overall conclusions drawn across the board are considerably different. CYFOR does consider cognitive bias in an investigation as do police forces but naturally, police forces are inclined to find evidence that may not be as it appears on the tin. CYFOR can focus investigations on these evidential findings and confirm or refute the evidence that otherwise would be blindly accepted by a court.